Microsoft Purview | Share block at external users
Hello community. I have an issue with Microsoft Purview DLP policies. I am trying to create a policy that prevents documents from being shared through OneDrive with external users, while allowing certain exceptions. However, when I select the option "Block Access to external domains and users" and assign a specific email address to be blocked, it does not work. The configured email address is not being blocked. I was reviewing this with Copilot, and it mentioned that if the external user you are sharing with already exists in Entra ID, the tenant may treat the user differently (not necessarily as an external user). My external user exists in Entra ID as a Guest account. The external user is registered as follows: Displayname: User Name Userprincipalname: user.name_external.domain#EXT#@company.onmicrosoft.com User Type: Guest Has anyone else experienced this issue? I am sharing evidence of the policy configuration.Ask Microsoft Anything: Why Cybersecurity Needs a New Security Stack for the AI Era with David Weston
David Weston leads Agentic Security at Microsoft, where he and his team build the AI models, autonomous agents, and evaluation systems redefining how defenders operate. At Microsoft since the Windows 7 era, he has worked across exploit mitigation design, malware analysis, APT research, and led security engineering for Windows, Xbox, Azure OS, and Microsoft's Offensive Security Research & Engineering group. His current work is leading teams training frontier security models, agentic security systems for defenders, and pushing AI-driven vulnerability discovery through Microsoft's Multi-Model Agentic Scanning Harness (MDASH). A longtime member of the research community and former CISA technical advisor, David is a regular presenter at BlueHat, Black Hat, and DEF CON. Key areas Dave and his team can discuss: The vision behind Project Perception How AI is changing the economics of cyber offense and defense Lessons learned from building MDASH and Microsoft's AI security initiatives Security-first AI development and deployment What's next for defenders as agentic systems become mainstream This will be a TEXT-BASED AMA, so ask your questions in the comment section down below and David and team will be answering via comment replies during the live hour!
Serious problems in Ring0 kernel-mode modules and security in current versions of Windows
We all know that in the X86 architecture CPUs have four different levels: Ring0(kernel-level), Ring1, Ring2 and Ring3 (user-level). The users, even administrators can only access Ring3, and Microsoft designed the operating system this way to make the system more safe and stable. On the other hand, Microsoft uses signs and security options like "Memory Integrity" in "Core Isolation" in Windows Defender. Normal applications need to use kernel-mode modules to gain access to the kernel (.sys), and if these modules need to be loaded by the system, it should be signed or it will be blocked by Windows Defender or other antivirus software. But now I found a really serious problem in Microsoft's signing activities. BEDaisy.sys is the kernel-mode driver of BattlEye, an anti-cheat software, and it is signed by Microsoft. In BattlEye's EULA, it said that "BattlEye can prevent the cheaters from gaming on the servers which are protected by BattlEye. ", and to make it happen, BattlEye needs to create a service and install kernel-mode components. (Please remember that User Account Control window won't pop up if a service or trusted installer tries to install a kernel-mode driver. ) This EULA is really confusing because it makes the users think "BattlEye does this to protect me from being attacked by other cheaters. " and then accept the EULA and install BattlEye. However, after BattlEye is installed, it can't even block a simple attack from the other cheaters. The other cheaters can even force crash your game. On the contrary, BattlEye tries to block the modules from any other applications which it thinks they are suspicious from loading. It can even block the modules of the anti-cheat software, which makes the protections of the system reduce or even put the system at risk. There is another case. There is a user found his computer attacked by the malware. He was really confused because he had installed the anti-virus software on his system. After looking into his system carefully, he found out that his anti-virus software was down and was killed by mhyprot2.sys, another kernel-mode module of an anti-cheat software. And mhyprotect2.sys is also signed by Microsoft. https://www.trendmicro.com/en_us/research/22/h/ransomware-actor-abuses-genshin-impact-anti-cheat-driver-to-kill-antivirus.html The kernel-mode drivers from both of the cases are signed by Microsoft, and as they run in Ring0 kernel-level, the users have nothing to do to stop them. And as they are signed, most of the anti-cheat software will be less sensitive to them and will be much easier to let them run. . Besides, Windows is designed for everyone, not just for game players. Not all the users would like to sacrifice the security of the system just to play the games. . On the other hand, unlike the cyber security companies, the game companies usually care more about the game itself than the entire system. And they are not responsible for any damage caused by the anti-cheat software. The thing that I am most angry with is that Microsoft actually signed these kinds of kernel-mode modules, which means Microsoft allow these kinds of dangerous things to happen. In my opinion, it is the player's duty to obey the EULA of the games, but it is the game company's duty to do their anti-cheat jobs, and if you want to use the player's device to help you anti-cheat and even want to have Ring0 access, you need to warn the users and notify them. In BattlEye's case, there are three windows will pop up on the screen when you try to install them, but all of them said that BattlEye will minimize its authority and none of them said it needs to gain the authority to shut down other software or block their activities. . . And in total, it is the users who paid for the device and the operating system which they are using, but not the game companies. Taking fully control of the device without noticing the user is illegal. In the end, I really hope that Microsoft can raise the standard of signing a kernel-mode module. These kinds of issues can happen not only in anti-cheat software, but also in any other software, only the problem occurred this time is the anti-cheat software. To tell you the truth, I think Microsoft can only sign the Ring0 kernel-level drivers of the hardware drivers and the anti-virus software. The other applications can only run in Ring3 user-mode like Android. I know it could be hard to make it happen, so you can add whitelist function for the users don't care too much about security or even let them turn off the security options. You can kill the malware by mistake because if that happens, the user can restore them and whitelist them. But you can't miss a malware, because if that happens, the responsibility is usually the one that you can't take. And if the software in the whitelist damages the system, then it is not you Microsoft's responsibility. And for the game players, you can also add isolated gaming environment like Hyper-V, but especially for games, and any other software can't run in it to prevent cheating. Thank you.
Virtualization-Based Security (VBS): Elevating Modern IT Protection
In the rapidly evolving world of cybersecurity, traditional approaches to protecting operating systems are being continuously challenged by increasingly sophisticated threats. Cyber attackers now target the very core of our computing environments, seeking privileged access that can bypass conventional defenses. In this context, Virtualization-Based Security (VBS) emerges as a transformative solution, leveraging hardware virtualization to create robust isolation for critical system processes. What Is Virtualization-Based Security? VBS is a security feature integrated into modern Windows operating systems. It utilizes hardware virtualization to establish a virtual secure mode—an isolated environment that runs sensitive security tasks, shielded from the main operating system. Even if malware compromises the OS, this isolated environment prevents unauthorized access to protected processes and data. At its foundation, VBS operates through a lightweight hypervisor, enforcing strict security boundaries. This architecture ensures that, even if an attacker gains administrative rights within the operating system, vital security assets remain inaccessible. Core Benefits of VBS Credential Protection With Credential Guard, VBS stores sensitive credentials—such as NTLM hashes and Kerberos tickets—in a secure container. This strategy effectively blocks tools like Mimikatz from extracting credentials, significantly reducing the risk of lateral movement attacks. Kernel-Level Code Integrity Hypervisor-Enforced Code Integrity (HVCI) ensures that only approved, digitally signed drivers and binaries can execute at the kernel level. This defends against rootkits and kernel-level malware. Zero-Day Exploit Mitigation By isolating mission-critical processes, VBS minimizes the attack surface and lessens the impact of previously unknown vulnerabilities. Secure Boot Synergy VBS complements Secure Boot, ensuring the device loads only trusted software at startup and preventing bootkits and early-stage malware. Enhanced Compliance and Assurance Organizations in regulated industries—such as finance and healthcare—benefit from VBS’s robust controls, which support regulatory compliance and increase stakeholder confidence in IT security measures. System Requirements for Deploying VBS To implement VBS, ensure the following prerequisites are met: Windows 10/11 Enterprise, Pro, or Education editions 64-bit architecture UEFI firmware with Secure Boot capability enabled Hardware virtualization support (Intel VT-x or AMD-V) TPM 2.0 (Trusted Platform Module) for Credential Guard functionality Adequate RAM (VBS may slightly increase memory consumption) Practical Applications: Challenges Addressed by VBS Enterprise Credential Protection: Prevents credential theft and lateral movement across networks. Driver Vulnerability Defense: Blocks unauthorized or malicious drivers from executing. Mitigating Insider Threats: Restricts access to sensitive processes, even for users with administrative rights. Combating Advanced Persistent Threats (APTs): Provides a hardened layer of defense that significantly complicates APT infiltration efforts. VBS: Transforming Security for IT Professionals and Organizations For IT Professionals: Stronger Security Posture: Defense-in-depth with minimal complexity Streamlined Compliance: Simplifies adherence to standards such as NIST, ISO 27001, and HIPAA Future-Ready Infrastructure: Lays the groundwork for secure hybrid and cloud environments For Businesses: Lowered Breach Risks: Reduces the likelihood and impact of data breaches or ransomware incidents Increased Trust: Demonstrates robust security practices to clients and business partners Business Continuity: Safeguards critical systems, ensuring operational resilience Conclusion Virtualization-Based Security represents more than just another operating system feature—it marks a paradigm shift in how organizations and IT professionals approach endpoint protection. By isolating and safeguarding the most sensitive components of the OS, VBS empowers businesses to stay ahead of evolving threats and secure their digital assets with confidence. Whether you are an IT administrator, a security architect, or a business leader, adopting VBS is a strategic decision that paves the way toward a safer, more resilient future in the Microsoft ecosystem.Princess Sumaya University for Technology Ranked as the first place in Asia With Cyber Competition
For the first time Cyber Competition was Held in March, 2nd 2019 in Jordan,This Competition had a lot of participants and as a result Princess Sumaya University Ranked 28th, 32nd places on Jordan and 3rd, 7th between the University Students. Moreover Ranked 1st place in Asia with 1,766 Points for the first time. The Competition reason was for measuring different topics such as Cryptography, Forensic, and Security Authorization Process.
